CVE-2024-23142
📋 TL;DR
A use-after-free vulnerability in Autodesk applications allows remote code execution when processing malicious CAD files (CATPART, STP, MODEL). Attackers can exploit this by tricking users into opening specially crafted files, potentially compromising systems running vulnerable Autodesk software.
💻 Affected Systems
- Autodesk applications using atf_dwg_consumer.dll, rose_x64_vc15.dll, libodxdll
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with system compromise, data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Malware installation, data exfiltration, or system compromise when users open malicious CAD files from untrusted sources.
If Mitigated
Limited impact with proper file validation, user awareness, and network segmentation preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in Autodesk Security Advisory ADSK-SA-2024-0009
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Review Autodesk Security Advisory ADSK-SA-2024-0009. 2. Identify affected products in your environment. 3. Apply latest patches from Autodesk. 4. Restart systems after patching. 5. Verify patch installation.
🔧 Temporary Workarounds
File Type Restriction
allBlock or restrict processing of CATPART, STP, and MODEL files from untrusted sources.
Application Control
windowsUse application whitelisting to prevent unauthorized Autodesk application execution.
🧯 If You Can't Patch
- Implement strict file validation and scanning for CAD files before opening
- Segment networks to isolate Autodesk applications and limit lateral movement
🔍 How to Verify
Check if Vulnerable:
Check Autodesk application versions against patched versions in advisory ADSK-SA-2024-0009Check Version:
Check within Autodesk application Help > About or via system inventory toolsVerify Fix Applied:
Verify installed version matches or exceeds patched version from Autodesk advisory📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Autodesk applications
- Multiple failed file parsing attempts
- Memory access violations in application logs
Network Indicators:
- Unexpected outbound connections from Autodesk applications
- File downloads of CAD file types from untrusted sources
SIEM Query:
Process creation where parent process contains 'autodesk' AND (command line contains '.catpart' OR '.stp' OR '.model')